Tech Risk and Controls Lead-Vulnerability Management, Network security controls

JPMorgan Chase & Co.; Jersey City (NJ); On-site; USD 140,000 - 190,000; Full time

Job summary

JPMorgan Chase & Co. is seeking a Tech Risk and Controls Lead to drive enterprise governance of vulnerability management.

You will coordinate across Product, Engineering, Operations, Risk Intelligence, and control design teams to ensure consistent oversight and accountability. The role emphasizes defining governance mechanisms, escalation paths, and performance metrics to strengthen discovery and remediation across cloud, data centers, and endpoints.

Qualifications

• 10+ years of experience in cybersecurity, technology risk, or governance.
• Experience leading enterprise vulnerability management governance or cross-functional oversight.
• Deep understanding of the vulnerability management lifecycle and controls.
• Ability to define decision rights, governance forums, and metric frameworks.
• Experience governing complex security ecosystems across tools and platforms.

Responsibilities

• Lead the enterprise Vulnerability Management governance function as a central coordination point across teams.
• Establish and maintain the governance charter, operating model, and escalation pathways.
• Coordinate across Product, Engineering, Operations, Risk, Standards and Control Design, and business units.
• Chair or coordinate governance forums ensuring evidence and timely decisions.
• Govern changes to discovery, coverage, feeds, scoring, and exemptions with impact assessments.
• Drive root-cause and thematic analysis of vulnerabilities and control failures.
• Define enterprise metrics and reporting on discovery, coverage, and remediation outcomes.
• Coordinate with Audit, Compliance, and regulatory teams for coherent explanations of scope and decisions.
• Promote automation and auditable governance patterns for timely decisions.

Skills

Governance leadership

Cybersecurity risk management

Stakeholder management

Executive communication

Analytics & metrics

Root-cause analysis

Job description

Join a role that's central to our technological controls and standards, offering a unique opportunity to shape the firm's tech controls strategy in alignment with various standards and regulatory requirements.As a Tech Risk and Controls Lead at JPMorganChase within Cybersecurity Technology and Controls, you will lead the enterprise governance and orchestration of the Vulnerability Management function. Serving as the central governance lead and connective layer across Vulnerability Management Product, Engineering, Operations, Risk Intelligence, Standards and Control Design, control owners, and line-of-business teams, you will establish clear decision rights, integrate end-to-end oversight, and drive consistent outcomes without displacing technical execution or remediation accountability. The role combines cybersecurity risk and controls expertise with enterprise leadership to strengthen discovery and coverage efficacy, material‑change governance, systemic issue management, metrics, regulatory readiness, and continuous improvement across cloud, data center, endpoint, application, container, and other technology environments.

Job responsibilities

• Lead the enterprise Vulnerability Management governance function, providing a central coordination point for cross-functional accountability, governance challenge, and escalation
• Establish and maintain the Vulnerability Management governance charter, operating model, decision rights, forums, RACI, materiality thresholds, and escalation pathways
• Orchestrate collaboration across Vulnerability Management Product, Engineering, Operations, Risk Intelligence, Standards and Control Design, control owners, Product Security, and line-of-business teams while preserving clear technical and remediation ownership
• Chair or coordinate enterprise Vulnerability Management governance forums, ensuring working groups prepare complete evidence and decision‑making bodies record accountable, timely, and traceable outcomes
• Govern material changes to discovery, coverage, feeds, integrations, scoring, filtering, bundling, exemptions, and inclusion or exclusion rules through documented impact assessment, testing, approval, communication, and post‑implementation validation
• Drive systemic root‑cause and thematic analysis of vulnerabilities, control failures, recurring defects, data‑quality issues, and finding concentrations; translate insights into enterprise corrective actions with clear ownership and tracked closure
• Define and oversee enterprise metrics and reporting that measure discovery and coverage efficacy, control outcomes, governance health, service performance, rule compliance, remediation trends, and downstream impact
• Coordinate enterprise responses to systemic issues and ensure local remediation, exception, and risk‑acceptance decisions remain with the appropriate control and business owners
• Partner with the Vulnerability Management Product or Service Owner on strategy, roadmap, prioritization, capability uplift, annual coverage review, and the distinction between routine improvement and material enterprise change
• Coordinate with Audit, Compliance, Operational Risk, and regulatory engagement teams to ensure Vulnerability Management leaders can provide coherent, evidence‑based explanations of firmwide scope, methodology, control outcomes, and material decisions
• Promote automation, reusable governance patterns, and auditable workflows that improve the quality, timeliness, and traceability of Vulnerability Management decisions and follow‑through

Required qualifications, capabilities, and skills

• Formal training or certification on tech risk and controls concepts and 10+ years applied experience in cybersecurity, technology risk, Vulnerability Management, security engineering, product or service governance, or controls leadership, including experience leading across organizational boundaries
• Demonstrated experience establishing or leading an enterprise Vulnerability Management governance, control tower, service‑integration, or comparable cross‑functional oversight capability
• Deep understanding of the Vulnerability Management lifecycle, including asset and provider coverage, discovery, scanning, intake, triage, risk rating, routing, remediation, exceptions, validation, reporting, and closure
• Proven ability to define decision rights, governance forums, RACI models, change‑control gates, materiality criteria, escalation mechanisms, evidence requirements, and outcome‑based metrics
• Experience governing complex Vulnerability Management ecosystems and data flows across multiple tools, providers, platforms, and hybrid technology environments
• Strong analytical capability in discovery and coverage efficacy, systemic root‑cause analysis, thematic analysis, control effectiveness, data quality, and enterprise risk reporting
• Executive presence and the ability to challenge constructively, resolve accountability gaps, influence senior stakeholders, and communicate complex technical and risk topics in cl